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We present a quantum version of the classical probabilistic algorithms a la Rabin. The quantum 
algorithm is based on the essential use of Grover's operator for the quantum search of a database and 
of Shor's Fourier transform for extracting the periodicity of a function, and their combined use in the 
counting algorithm originally introduced by Brassard et al. One of the main features of our quantum 
probabilistic algorithm is its full unitarity and reversibility, which would make its use possible as 
part of larger and more complicated networks in quantum computers. As an example of this we 
describe polynomial time algorithms for studying some important problems in number theory, such 
as the test of the primality of an integer, the so called 'prime number theorem' and Hardy and 
Littlewood's conjecture about the asymptotic number of representations of an even integer as a sum 
of two primes. 



PACS numbers: 03.67.Lx, 89.70.+C, 02.10.Lh 

I. INTRODUCTION 

Quantum computers allow a superposition of |0 > and 
|1 > qubits with coefficients being complex numbers a 
and ft, 



\tp >= a\Q > +ft\l > 



(1) 



It is this superposition which provides us with an enor- 
mous number of parallel computations by generating a 
superposed state of a large number of terms, for example 
starting with the fiat superposition (|0 > +|1 >) N . 
Quantum computers can do unitary transformations and 
also make quantum mechanical observations which in- 
duce an instantaneous state reduction to |0 > or |1 > 
with the probability |a| 2 or \ft\ 2 , respectively [1-3]. 

At present there are two main kinds of interesting 
quantum algorithms which can beat their classical coun- 
terparts, i.e. Shor's algorithm for factoring integers Q] 
and Grover's algorithm for the unstructured database 
search || which achieve, respectively, an exponential and 
square root speed up compared to their classical ana- 
logues. One of the most interesting algorithms where 
these two basic unitary blocks are exploited in conjunc- 
tion is the counting algorithm introduced by Brassard et 
al. H (see section 3 for a detailed description), which 
can count the cardinality t of a set of states with a given 
property present in a flat superposition of N states in a 
time which is polynomial in the ratio N/t, and with an 
accuracy which can be made exponentially close to one. 

In this work we shall show how an extended use of 
this algorithm can be exploited to construct unitary and 
fully reversible operators which are able to emulate at 
the quantum level a class of classical probabilistic algo- 
rithms. Classical probabilistic algorithms are character- 
ized by the use of random numbers during the computa- 
tion, and the fact that they give the correct answer with a 
certain probability of success, which can be usually made 



exponentially close to one by repetition (see, e.g., ref. 
§). In this paper we show explicitly a series of quantum, 
fully reversible and unitary algorithms which can be seen 
as the quantum analogue of the aforementioned classical 
randomized algorithms, in the sense that they naturally 
select the 'correct' states with an arbitrarily large proba- 
bility amplitude in the end of the computation, and that 
the final measuring process is only an option which may 
not be used, e.g., in the case when the 'answer' provided 
by such quantum algorithms is needed as a partial (sub- 
routine) result for further computations in a larger and 
more complex quantum network. The main ingredients 
for the construction of our quantum algorithms consist 
in the repeated use of the quantum counting transform 
of ref. the exploitation of the resulting interference 
and entanglement among quantum states and, to some 
extent, in assigning to some extra ancilla qubits the role 
analogue of the classical random repetitions. Previous 
work H (see also ref. j| for other types of subroutines 
in the context of generalized quantum computation) also 
dealt with the problem of building unitary and reversible 
subroutines for the use in larger quantum computational 
networks. However, as quantum interference is not ex- 
ploited, these methods in general require a larger memory 
space compared to our algorithms (see also the footnote 
at the end of section III). 

The paper is structured as follows. In section 2 we 
summarize the main properties of one of the prototypes 
of the classical randomized algorithms, i.e. Rabin's test 
for primality of an integer. In section 3 we describe the 
main block of our quantum algorithm and, as a warm up 
exercise propaedeutical to section 4, we study again the 
case of the test of primality for a given integer, compar- 
ing our results with the classical ones. In section 4 we 
extend our quantum methods to the problem of check- 
ing the so called 'prime number theorem' concerning the 
distribution of primes smaller than a given integer. We 
conclude in section 5 with some discussion and future per- 
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spectives. Finally, in the appendix we suggest how one 
might test Hardy and Littlewood's formula concerning 
the asymptotic behaviour of the number of representa- 
tions of a given even integer as the sum of two primes, 
and also comment about the possible proof of a famous 
Goldbach's conjecture in number theory. 



II. CLASSICAL RANDOMIZED PRIMALITY 
TEST 

One of the prototype examples of classical probabilistic 
algorithms is that of Rabin M for testing the primality 
of a given number fc.[] The algorithm is probabilistic as it 
uses random integers during the computation, it is always 
correct when certifies a number to be composite, while it 
asserts primality with an arbitrarily small probability of 
error. The algorithm tests the following condition Wk(a), 
for 1 < a < k (and factoring out of k — 1 the highest 
power of 2 which divides it, i.e. writing k — 1 = 2 1, with 
h integer and I odd): 



(i) a mod k ^ 1; 
(ii) 3 i e [1, h] I gcd(a 



(k-i)/r 



,k)^l. 



(2) 



If at least one of conditions (i) or (ii) is satisfied, then 
Wk(a) = and a is said to be a witness to the com- 
positeness of k. On the other hand, if neither (i) nor 
(ii) are satisfied, then Wk(a) = 1. The most important 
property of the witness function Wk (a) is that for a com- 



posite number k 
Wk c (a) =0 is 



kc the number tk c of witnesses a s.t. 



tk c > 



3(fc c - 1) 



(3) 



i.e., for a composite kc it is guaranteed that at least 
3/4 of the a < kc are witnesses to kc 0- jllj (see also 
rcf. [T^]). For a prime number k = kp, instead, none 
of the a is a witness (i.e. Wk P (a) = 1 for all 1 < a < 
kp). Conversely, if, for an integer 1 < a < k picked at 
random, one finds that Wk{a) = 1, then one can correctly 
declare k to be prime with a probability 3/4, while, if one 
finds Wk(a) — 0, then k can be declared composite with 
certainty. 

The classical randomized algorithm for the test of pri- 
mality of k heavily relies on this property of the witness 
function Wk and proceeds as follows. Given the number 
k to be tested, one first picks up randomly h numbers 
a,i s.t. 1 < a,i < k (i G [1, ft]) and checks their witness 
function Wk(cii). If Wk(a.i) = for at least one of the a^, 



*For a review of other probabilistic and deterministic classi- 
cal tests of primality see, e.g., ref. fllCf. 



then fc is declared composite, while if Wk(ai) = 1 for all 
ai, then k is declared prime. If fc is declared composite 
the test is always correct, but if k is declared prime the 
test may fail with a probability (i.e., the probability of 
independently picking h 'false' witnesses) smaller than 
l/2 2h 0. The computational complexity S c i ass of the 
algorithm, defined as its running time as a function of 
the number of required operations, is polynomial in the 
number of digits of k, i.e. S c iass — 0[h polyilogk)]. [j] 

We stress once more the main point leading to the 
good performance of the classical randomized algorithm, 
i.e. the large gap between the number of witnesses in the 
cases when k is a prime and when it is a composite. 



III. QUANTUM PRIMALITY TEST 

Let us now present, at first, also as a useful 'warm-up' 
exercise, a quantum algorithm to test the primality of a 
given number k and compare it with the classical prob- 
abilistic one by Rabin. The main idea underlying our 
quantum computation is the repeated use of the count- 
ing algorithm COUNT originally introduced by Brassard 
et al. ||. The algorithm COUNT makes an essential 
use of two of the main tools in quantum computation, 
i.e. Grover's unitary operation G for extracting some el- 
ements from a flat superposition of quantum states, and 
Shor's Fourier operation F for extracting the periodicity 
of a quantum state. Grover's unitary transformation is 
given by G = — WSoWSi, where the Walsh-Hadamard 
transform W is defined as 



W\a>=-^=J2^ ab \ b> 



fc-i 



(4) 



fc=0 



(with a-b = aibi mod 2, aj(6j) being the binary digits 
of a{b)), S = I-2\0 >< 0| and Si = I-2J2 W \w >< w\, 
which changes sign to the searched states |k; >. [j] Shor's 
operation is, instead, given by the Fourier transform^ 



F\a 



1 



\b> 



(5) 



^One has to randomly generate (e.g., tossing 0[logfc] coins) 
h numbers, taking 0[log k] steps for each number, and to eval- 
uate the witness function for each of these numbers, taking 
another 0[ poly(log k)] steps [Q. 

*From here onwards, for simplicity, we use the compact no- 
tation according to which, e.g. assuming b ~ 0(k), we have 
b = 2 3 bj + 2 J - 1 b J _i + ... + 2°b (with j = [log A;]) and |6 > 
itself is actually an acronym for the tensor product of j + 1 
qubits, i.e. \b >= \bj > > x... x |6o >■ 

''Note that one can write the flat superposition as W\0 > = 
F\0>=J2 a \a> /Vk. 
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Then, the COUNT algorithm can be summarized by the 
following sequence of operations: 



COUNT: 

1) (W\0 >){W\0 >) = 

3) — > measure |m > 



: E„>>E>> 

> G m (Ea l« >)] 



In the following we will assume that P is at most ~ 
0[poly (log k)], so that the steps required to compute the 
repeated Grover operations P] G mi+, -+ ms is polynomial 
in log 

We define the quantities 



and 



(9) 



Since the amplitude of the set of the states \w > after 
m iterations of G on \a > is a periodic function of m, the 
estimate of such a period by use of the Fourier analysis 
and the measurement of the ancilla qubits in \m > will 
give information on the size t of this set, on which the 
period itself depends. The parameter P determines both 
the precision of the estimate t and the computational 
complexity of the COUNT algorithm (which requires P 
iterations of G). 

Our quantum algorithm for the test of primality makes 
essential use of the COUNT algorithm for estimating the 
number of witnesses to the compositeness of k, and of 
-RlogP ancilla qubits \rrii >i (with nii € [0, P], i E [1, R] 
and P is an integer power of 2 to be determined later) 
which are finally measured and which arc necessary in or- 
der to sharpen the constructive interference of the 'good' 
states. 

We start with the tensor product of R |0 >; states with 
logP qubits, and one state |0 > with logfc qubits, i.e. 



|V>o >= |0>i ....|0>r |0> 



(6) 



and then act on each of these states with a Walsh- 
Hadamard transform W in order to obtain 



l TO l >1 Em s =0 



^P-l 



\i>i >= 



p 



p 



Vk 



(7) 



We then act on the last \a > state with the \m\ >i 
..\mR >r- 'controlled' Grover operation G m s.t. 

, , . E™7=o l"»i >i Em~Lo \ m R >R 

\V2 > = 



P 



P 



Ea=o G mi+ "" +m "|a > 



(8) 



where in G we use Si = I — 2J2w k (a)=o \ a >^ a l) wn ich 
changes sign to the witnesses of the compositeness of k. 



**A unitary transformation representing the witness func- 
tion Wk{a) can be easily obtained by defining the quantum 



k mi ....m R = sin[2(mi 



m R ) + l]6 k 



mi niR 



cos[2(mi + .... + tyir) + l]0fc, 



(10) 



where tk is the number of a s.t. 1 < a < k and Wk(a) = 0, 
and the states 



\Bi >k = -)= \ a> 

Vtk W k (a)=0 

^t)=t 



a >, 



(11) 



such that we can simplify eq. (S) by use of 



A— 1 



lm 1 ....m R \B 2 > fe . (12) 



Vk 



a=0 



Next we apply Shor's Fourier transform on each of the 
R ancilla states \rrii >; in order to extract the period- 
icity 8k (and, therefore, via eq. (||), the number of wit- 
nesses tk) which is hidden in the amplitudes k mi ....m R 
and l mi ....m R1 i.e. we transform \ip2 > into 



AND of the basic operations in (i) and (ii) in eq. (|2|), 
each of which can be evaluated in a time which is poly- 
nomial in log k. For instance, one can first evaluate h in 
k — 1 = 2 h l by reading the highest qubit in k — 1, and 



then build the state \W^"(a) > ....\Wf'(a) > \W k (a) >, 
where W { k 0) (a) = Q[a k ^ 1 mod k], for i G [l,h] we have 
Wjf ^a) = e[GCD(a (fc - 1)/2 \fc) - 1 mod (k - 1) + 1], with 
B[l] = 1 and B = otherwise, and where |Wfc(a) >= 
\W ( °\a) AND.... W ( k h \a) >. The operator Si £ a |o >= 
— E a ( — 1) |o > can then be easily realized by tensoring 
the states \a > with the ancilla qubit |e >= [|0 > — 11 >]/v2 
and acting with Uw k : |a > |e >^ a > |e + ^(a) mod 2 >. 
All the operations leading to the evaluation of Wk(a), except 
the last for the phase change, have to be undone again, as 
usual, before acting with Si and G. 

^Each of which has a computational complexity Sa — 
0[poly(\ogk) + logfc] ~ 0[poly(log k)], the first term being 
for the quantum parallel evaluation of the witness functions, 
and the second term for the evaluations of the W and So 
transforms. 
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P 



spP-l 2M R m R /P\i > 



P 



x [k \B 2 > k ). (13) 

After some elementary algebra, eq. (|l3l ) can be rewrit- 



ten as 



p-i 



-i7r(ii+....+/ R )P 



il,..iR=0 

R 



II'li+M^l >^ +1^2 >fc) 



+ n^ ( f-(^i > fc + |P 2 > fc ) 



where we have introduced the following quantities, 



(14) 



fk 



POk 

IT 

fk 



R 



0<f k < 



(1-P) 



P 



P 



and 



^ ( P) _ sin7r(/ i ± f k ) 
Psm - n J ' 



(15) 



(16) 



In particular, when counting the witnesses for a given 
k, we have two different possibilities: either k is a prime, 
in which case we have that tk P = and therefore 9 kp — 
fk P — 0; or k is a composite, for which we have that 
tk c > 3fcc/4 and 9 kc > 7r/3, implying that P/3 < //- G < 
F/2. 

Going back to eq. (|l4|), we can see that, in the case 
when k is a prime, G effectively acts as an identity oper- 
ator, so that \ip$ > simplifies to 



\i> 3 >^ |0>! ....|0> H \B 2 > h 



when k 



(17) 



On the other hand, when A: is a composite, almost all 
of the ancilla qubits in \ip3 > will be in a state different 
from |0 >i ....|0 >r. In fact, the probability of finally 
measuring |0 >i ....|0 >r when k is composite is 



P(|0>i ....|0> fl ) 



fee 



< 



(a k ) 2R 



fee 
2R 



sin Trf k 



Psin 



2R 



Elk 



0[P- Z % (18) 



since we have fk c > P/3. 

Summarizing the above results, our quantum algo- 
rithm for testing the primality of a given number k is 



probabilistic in the following sense: if in the final mea- 
surement process of the R log P ancilla qubits we obtain 
a state with at least one of the qubits different from |0 >, 
we can declare with certainty that the number A: is a com- 
posite] on the other hand, if all the ancilla qubits are in 
the state |0 >, we can claim with an error probability 
smaller than 0[P~ 2R ] that the number k is a prime. 

The use of R log P ancilla qubits and the repeated ap- 
plication of the Fourier transforms is made in order to 
sharpen the constructive interference effects at the basis 
of the measurement of the period 9 k and, in this sense, 
it can be seen as the quantum analogue of the multiple 
random tests used in the classical primality algorithm by 
Rabin. Moreover, our algorithm, provided that the final 
measurement step is omitted, is clearly unitary and fully 
reversible, and as such it can be used as an intermediate 
unitary transform inside a larger and more complicated 
algorithm. The strength of this quantum algorithm then 
critically relies on the use of the superposition and entan- 
glement of states, and above all on the existence of a gap 
between the cardinalities of different sets of the domain 
of a given test function (in the case of the function W k (a) 
the domain is divided in the set of states with Wk = 1, 
fk = 0, and those with W k = 0, f k > P/3). We will 
show other and more interesting problems where these 
properties can be fruitfully exploited in section 4 and in 
the appendix. 

The computational complexity of the quantum algo- 
rithm can be written as S quan t — 0[logfc + P{logP + 
(logP) 2 + PS G }} ~ 0[RPS G ], ^ with the number of 
steps required for G given by Sq — 0[poly(log k)] (see 
footnote below eq. @), so that we obtain S quan t — 
0[R poly (log k)]. ~ 



M Taking f good = (i.e., a good = 1) and, more in general, 
fbad = £P/2 with £ G (0, 1], and requiring a success prob- 
ability exponentially close to one, we have to choose, e.g., 
a b ad < (-Psin7r£/2) -1 < 1/2 in eq. @. Thus, actually even 
small values of £ (but £ > [poly(\og TV)] -1 ) are good enough 
for the quantum test to be sufficiently reliable, provided one 
takes P > 0[£ -1 ]. 

§ § The first term is for the construction of the flat superpo- 
sition y2 \a>, while the other terms arise, in the order from 
left to right, from the evaluations of the R flat superpositions 
of the ancilla states [raj >j [i G [1,-R]), the R Fourier 

transforms on the same states and the operation , re- 

quiring PR repetitions of the basic block G. 

***One might observe that, in fact, it is not necessary to 
use COUNT for primality testing, but simply build the state 
\^2 a \a > \Wk(a) >] (for the bases a of the integer k), mea- 
sure the ancilla qubit |Wfc(a) > and repeat the procedure h 
times. This would imply the same error probability P e ~ 
2~ 2h (after h trials), computational complexity S qU antum — 
0[poly(\og k)] and memory space required M — logfc + 1 as 
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IV. COUNTING K P <N AND THE PRIME 
NUMBER THEOREM 

One of the problems in which the quantum algorithm 
of the previous section can be explicitly used, as the basic 
block of another more complex unitary operation, is the 
case of the testing of the so called 'prime number theo- 
rem' (see, e.g., ref. |h]] and references therein), according 
to which the total number tjv of primes kp smaller than 
a given number N is given by the formula 



t N = tt{N) 



N 



log TV 



(19) 



Our quantum algorithm essentially consists of a sub- 
loop which checks for the primality of a given k < N by 
counting its witnesses, a main loop for the counting of 
primes less than TV, and a final measurement of some an- 
cilla qubits. More in details, we can schematically sum- 
marize the main operations in the following steps: 



MAIN-LOOP: 

Count ${k\k = k P <N} using COUNT with G^G 
and Si —>■ Si = 1 — 2 ^ fe \kp >< kp\ (parameter Q) 
SUB-LOOP: 

Parallel primality tests V k < N (parameter P) and 
(approximate) construction of Si 



where Fk = 1 for a prime k — kp and Fk = for a 
composite k — kc- 

In order to construct such an Si, we start from the 
flat superposition of states \k > tensored with two ancilla 
states |0 >p and |0 >k with, respectively, logP and log/-c 
qubits, i.e. 



1-00 >= 



1 

7 =^|fc>|0>p|0> fe , 

^ k=0 



(21) 



and we act on the first two states (|fc > and |0 >p) in 
eq. ( ^l|) with an F transform and a |fc >-'controlled' F 
operation, respectively, to get 



N-l 



-L E I* > Em ^T >P Ea =°i- a >k (22) 



fc=0 



P 



Vk 



(with P ~ 0[poly (log N)]). Then, as usual, we operate 
with a \m >p- 'controlled' Grover transform G m on the 
last ancilla states \a >k followed by a Fourier transform 
F on \m >p, obtaining 



JV-l 



1^2 > 



^Ei fc 



> 



fe=0 



a k \0 > P \A > k 



p-i 



2J 4>m\m >p I An >A 



(23) 



where 



Let us start from the SUB-LOOP of the algorithm first. 
The unitary transform Si to be computed should approx- 
imate with a high level of accuracy the following basic 
operation 



N-l 



JV-l 



S 



1 : -LV|A>-> J= V(-l) 



fe=0 



\k>, 



(20) 



fe=0 



in our algorithm with the choice R = 1, P ~ O(l) repeated h 
times, and in the classical algorithm of ref. However, this 
method of repeated trials would not make the subroutine for 
primality testing unitary and reversible. To achieve this goal, 
one might instead consider (see, e.g., ref. ||) the initial state 

E 0l > \ W k(ai) >] Y, aR \ aR > \Wk(a R ) > and par- 
allely check for the R ancilla qubits \Wk(ai) >, for 
which the error probability would be P e> {, erme tt — 2~ 2R , 
the computational complexity would be S 'quantum, bennett — 
0[R(poly(log k))] and the memory space used would be 
M bennett = R(logk + 1). With the choice P ~ O(l) and 
R ~ O(logfc), however, our algorithm has the same error 
probability and computational complexity, but requires log- 
arithmically less memory space. This makes explicit the ad- 
vantage of exploiting the interference among quantum states 
which is inherent in our method via the use of COUNT. 



|A >fe 
\A m > k 



= smirf k \Bi > k + cosnf k \B 2 >k 
= [e-^ S ^2(i|Si > k +\B 2 > k ) 
+ e-^HlBi > fe + \B 2 >k)}/2 (24) 



while sin 6^, |-Bi,a >k, fk, s^fl and a*, have been defined, 
respectively, in eqs. (g), (JLljj, flU), © and @, and 
the phase m = exp[i7rm(l — l/P)]. 

We now act with the phase change operator So on the 
first ancilla state |- >p, and then undo again all the pre- 
vious operations (F, G m , and the two initial Fs) finally 
obtaining the state 



N-l 

\fa >= -7= E \ k > [1° >p 1° >fc — 2 |Ci >PJ 

* k=0 



(25) 



with 

Ci >p.fe 



p-i fc-i 

« fc e E e_2 "" r/p [( ImZfe ^) Bi ^( 6 ) 



n,r=0 b=0 



+ (Re Z k ,r)B 2tk (b)} 



\n > P \b > k 

pVk 



(26) 



and 



5 



-2i7rab/k 



B 2 , k (b) 



3 — 2i-Kab/k 



J k,r 



Vk - t k 

= pinfk p ~2i-rrf k r/P 



Noting the properties that p^ < C\\C\ >pj 
and, for a prime kp, a kp — 1, with \C\ >p.k P ~ 
1 > k P , we can also rewrite eq. (p5|) as 



where 



SSo >= 1^3 >= I* > +\E>, 



(27) 
|0 > P 
(28) 



JV-l 



|* > 
\E> 



k > 10 > P 10 > h 



\k > |Ci >p,k, 



(29) 



k—kr 



which realize, as wanted, the operation S\ of eq. (20), 
with the norm of the correction term \E > upper 
bounded by 



< E\E > 



N 



E 

k=kc 



a k 



< 4 



VV3P 



o[p- 



(30) 



Defining, in a symbolic notation, the sequence of op- 
erations 

Ui= F [CTRL [m>p {G)\ [CTRL\ k> (F)\ F, (31) 
we have, in fact, 

Si = UlSoUt. (32) 

Let us now consider the MAIN-LOOP of the algorithm, 
i.e. that counting the total number of kp < N. Grover's 
transform G entering this part of the algorithm can then 
be written as 



G=U 2 S 1 



U 2 = -W^S {k) W^ k \ 



(33) 



and with the caveat that now the operations W^ k ' and 
Sq^ appearing in the operator U 2 of eq. (33) are acting 



on the states \k >, and that the states to be counted 
finally are those with k — kp. 
Defining as usual 



sin 9 N = W — 



and the 'good' and 'bad' states, respectively, as 



\ G > = ^l fc > 10 >p 10 >k 



\B> 
we have then 



tN 

Ekg \k > |0 >P |0 >fc 
VN-t N 



(35) 



Si\G> =-\G> 

Si\B > =\B> + sec9 N \E > 



(36) 



Consequently, we can derive a formula for the iteration 
of the operator G acting on the state |V>o >, i-e. 



G n $a >=G n \iP >+\E n >, 



with 



\E n >= seel 



'N 



U 2 \E>, 



(37) 



(38) 



where we have again used the variables k m = sin(2m 
1)9n and l m = cos(2?ti + 1)8 n, the formulas 



|Vo > = sin6 N \G >+ cos 9 N \B > 
|* > = -sm9 N \G > +cos9 N \B > 



(39) 



and eq. (]3q) . 

We have now all the building blocks necessary to pro- 
ceed with the construction of the quantum algorithm 
counting the number of kp s.t. kp < N. We start from 
|V>o > given by formula (|2l|) and tensor it with a flat 
superposition of ancilla states |m >q with logQ qubits, 
i.e. 



|V>4 >= 



1 Q-i 



> 



(40) 



(with Q an integer power of 2 to be chosen later of 
0[poly(\ogN))), then we act on |i/S > with the \m >q- 
'controlled' G m and with F on \m >q, getting 



Q-i 



1*00 > 



- E 



> Q [k m \G > +l m \B > 



m,n— 



Q-i 



\Em >] = \ E 



iim(l-l/Q) 



n >Q [e 



x (i\G > +\B >) + e iw ^s^{-i\G > +\B >)] 
Q-i 



1 E 

m,n— 



3 2z7rmn/Q 



71 >Q |-E m >, 



(34) where 



/q = Q9n/k 



(41) 



(42) 



and are defined in eq. ([HI 



G 



Now, the last step of the algorithm consists in mea- 
suring the value of the state |- >q in |^ 5 >. Using the 
expected estimate that 6m ~ 0[l/^/log N\, which gives 
/ Q ~ 0[Q/\fiag N], and by choosing 

Q ~ O[(logN) ] ; /3>l/2, (43) 

we get the ansatz 1 < /q < Q/2 — 1 of ref. ||. Then it can 
be easily shown, exactly as in ref. ||, that the probability 
W to obtain any of the states |/_ >q, |/ + >q, |Q — 
/- >Q or |0 - /+ > Q (where /_ = [f Q ] + Sf and /+ 
/ ■ I . with < Sf < 1) in the final measurement is 
given by 



W> — 



En\ 



(44) 



where W^e„ is the contribution coming from terms in- 
volving \E n >, and whose explicit form we omit here for 
simplicity. 

Using the upper bound < E n \E n >< 0[n 2 ] < E\E > 
and choosing 



P~0[(logJV)T] ; 7 >/3, 
from eq. (|3(]) we then get the estimate^] 

<E n \E n > <0[(logiV)- 2 ^-' 3 )]«l 



(45) 



(46) 



which, substituted in the formula for We„ and, then, in 
eq. (E3), finally gives the estimate 



W > -iL {l-0[(logiV)-^-«]}. 



This means that with a high probability we will always 
be able to find one of the states \ f± >q or \P — f± >q 
and, therefore, to evaluate the number t/v from eqs. (|34|) 
and 



Of course, as explained in ref. |6J, since in general Jq is 
not an integer, the measured /q will not match exactly 
the true value of /q, and we will have some errors. In 
particular, defining tjv = N sin 2 On, with On — 0n(/q), 
we have for the error over ijy the estimate p| 



|A<Ar| exp = \t N — t N \<n 



N 




0[N (log N) 



-13-1/2] 



(48) 



tt+The condition (^) is sufficient but not necessary in order 
to have |Ws„| <C 1. In fact, one can also choose P = cQ, 
provided that the constant c<l. 

""'"We note that, as an alternative of choosing P as in eq. 
( [l5| ) , one could also repeat the counting algorithm a sufficient 
number of times, as we did in the previous section (see eq. 
(M)), in order to reduce the 'error' probability We„- 



On the other hand, if we want to check the theoretical 
formula = ir(N) up to some power S > in log N, i.e. 
with 



\At N \ th ~0[N(logN) 



s-n 



(49) 



we have to impose that the measuring error over is 
smaller than the precision required for testing tpf, i.e. we 
should have |At7v|ea;p < |Atjv|t/t, which can be satisfied 
provided that 



(3 > 6 + 1/2. 



(50) 



The computational complexity of the quantum algo- 
rithm can be written as Sq ~ (9[logiV+log(5+(logQ) 2 + 
Q(logN + Si)], where for the SUB-LOOP we have Si ~ 
Oflog + log P + PSq + (log P) 2 ] , and which, using eqs. 
(Q), ( ^5|) and Sg — 0\poly (log N)], finally gives the poly- 
nomial complexity So — 0[QPSg] — 0\poly (log N)]. 

As noted in ref. j6j, moreover, one can further min- 
imize the errors by successive repetitions of the whole 
algorithm. In particular, it is easily seen that the success 
probability W can be boosted exponentially close to one 
and an exponential accuracy can be achieved by repeat- 
ing the whole algorithm many times and using the ma- 
jority rule, still leaving the whole algorithm for the test 
of the 'prime number theorem' polynomial in log TV. 



We conclude by stressing, once again, that the power 
of our quantum probabilistic methods essentially relies 
on: the gap between the cardinalities of the domains of 
the test function Wk\ the fact that the probability to 
(47) obtain any of the states f^oiQ — / ± is bigger than 1/2 
(which is true provided that the 'error' terms \E n > have 
sufficiently small amplitude); that, finally, the error over 
the estimate of tjv is smaller than the precision we need 
(the last two conditions being strongly dependent on the 
choice of Q, Q/P, y/k/tk and y/N/t^)- 



V. DISCUSSION 

In this paper we have shown a method to build a quan- 
tum version of the classical probabilistic algorithms a la 
Rabin. Our quantum algorithms make essential use of 
some of the basic blocks of quantum networks known 
so far, i.e. Grover's operator for the quantum search of 
a database, Shor's Fourier transform for extracting the 
periodicity of a function and their combination in the 
counting algorithm of ref. [pi. The most important fea- 
ture of our quantum probabilistic algorithms is that the 



^ § The average computational complexity can be further, 
slightly reduced by use of parallelism and anticipate measure- 
ments [6, 12]. 
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coin tossing used in the correspondent classical proba- 
bilistic ones is replaced here by a unitary and reversible 
operation, so that the quantum algorithm can even be 
used as a subroutine in larger and more complicated net- 
works. In particular, we described polynomial time al- 
gorithms for studying some problems in number theory, 
e.g. a primality test, the 'prime number theorem' and 
a conjecture concerning a certain distribution of couples 
of primes. Our quantum algorithm may also be useful 
for other similar tests and counting problems if there ex- 
ists a classical probabilistic algorithm which somehow can 
guarantee a good success probability (e.g., problems re- 
lated to the distribution of primes and pseudoprimes in 
number theory etc.). It is well known that in a clas- 
sical computation one can count, by using Monte-Carlo 
methods, the cardinality of a set which satisfies some con- 
ditions, provided that the distribution of the elements of 
such a set is assumed to be known (e.g., homogeneous). 
One further crucial strength and novelty of our algorithm 
is also in the ability of efficiently and successfully solve 
problems where such a knowledge or regularities may not 
be present. 



APPENDIX A: TESTING HARDY AND 
LITTLEWOOD'S CONJECTURE 

A very similar procedure can be followed for testing 
Hardy and Littlewood's conjecture 15 that the num- 
ber, which we call r 2 (2N), of the possible representa- 
tions of an even number 27V as the sum of two primes 
kp,lp < 2N such that kp + lp = 2N, should be given 
by the asymptotic formula (modulo 0[loglogiV] factor 
corrections Eq]) 



r 2 (2N) 



O 



iii 



N 



(log NY 1 



(Al) 



The quantum algorithm for counting such couples and 
testing the conjecture can be built starting from the state 



l^o > = 



1 



2JV-1 



\k>\2N-k> 



v *" fc=0 
X |0>! |0> 2 |0> 3 |0> 4 



(A2) 



where the four ancilla states |0 >j have, respectively, 
logP qubits for i = 1,2 and log(27V — 1) qubits for 



* Other quantum algorithms dealing with problems in num- 
ber theory, such as integer factoring, finding discrete loga- 
rithms or a Pocklington-Lehmer primality test can be found, 
respectively, in refs. and |l3| . The extent to which the 
algorithm presented in the latter work, however, can be actu- 
ally used as an efficient primality test is very questionable for 



i = 3,4, and then, as done in section 4, constructing 
an operator S[ such that 



S[: |0o >^ |*o > +\E' >, 



(A3) 



with the main contribution |$o > given by the wanted 
phase change for the 'good' states \kp > \(2N — k)p >, 
i.e. 



2JV-1 



1$ 



o> =-^= Y (-l) Gk \k > \2N-k > 
V2N z -' 



fc=0 

X |0 >1 |0 >2 |0 > 3 |0 >4, 



(A4) 



where G k = 1 for the 'good' couples \kp > \(2N — k)p > 
and Gk = for all the other couples, and \E' > is a 
correction whose amplitude should be negligible with re- 
spect to that of |$o >• This result is achieved, once 
again, starting from |0o > and acting with an F on the 
first two ancilla states, with a \k >- and |2iV — k >- 
'controlled' operator F, respectively, on each of the last 
two ancilla states, then operating with a controlled-G 
transform on each of the last two ancilla states and with 
an F transform on each of the first two ancilla states, 
inverting the phase of the state |0 >i |0 > 2 |0 >3 |0 >4 
and finally undoing the previous oper ations a gain. Do- 
ing so, one obtains as promised eqs. (A3-A4), with the 
explicit formula for the state \E' > given by (we omit 
all the algebraic details of the derivation for the sake of 
simplicity) 



2N-1 



\E' > 



ot k .a {2N _ ky \k' > \(2N-k)' > 

fc'=0 

x \C 2 > k >, (A5) 



/2N 



where the sum k' is over all couples except \kp > \(2N — 
k)p >, and the norm of the state \C 2 >k' (a certain 
tensor product of the four ancilla states) is of 0(1). 

To count the number of 'good' couples one has to re- 
peat exactly the same steps as described from eq. ( |3^ ) 
(with §x ->• S[) to eq. @ (with t N r 2 {2N)) in sec- 
tion 4, and the final result is that, again, the expected 
theoretical behaviour of r 2 (2N) can be tested up to ex- 
ponential accurarcy in a polynomial number of steps. In 
particular, if one takes 



Q~O[(logJ\0'] 
P~0[{\ogNY] 



P> M/2 
a > p, 



(A6) 



so that 1 < f Q < Q/2 - 1 in the MAIN-LOOP of 
the algorithm, that < E' n \E' n >< 0[P- 2(a -^] and 
W > 8/tt 2 {1 - OlP-^-ri]}, if we want to test the 2N- 
dependence of r 2 (2N) with a theoretical error 

\&r 2 {2N)\ th ~0[N{\ogN)-»- v ] ; v > 0, (A7) 

the condition | Ar 2 (2N)\ exp < \ Ar 2 (2N)\ t h requires that 
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p > fi/2 + v. 



The evaluation of the quantum computational com- 
plexity of the algorithm can be shown to be polynomial 
in the number 2N in a fashion similar to section 4. 

Finally, we should comment that the method used 
could be easily extended to other similar counting prob- 
lems, such as the case, e.g., when one wants to check 
that a given integer is the sum of more than two primes 
or their certain powers etc... In fact, provided that one 
is able to check with this quantum algorithm that any 
odd integer less than Nq = 10 43000 (!) |l(| can be written 
as the sum of three primes, then one might also have a 
numerical (although probabilistic) tool to prove with a 
polynomial computational complexity the weaker version 
of a famous Goldbach's conjecture, i.e. that every odd 
integer N > 5 is the sum of three primes (see, e.g., ref. 
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